viirya opened a new pull request, #21:
URL: https://github.com/apache/spark-connect-gateway/pull/21
### What changes were proposed in this pull request?
The `deploy/examples/e2e-auth-jwt` walkthrough is the only thing that
exercises the
Helm chart's auth block end to end. The in-process tests cover
`JwtAuthenticator`
itself, but nothing rendered the chart's `auth.type: jwt` ConfigMap or drove
a real
PySpark client through the bearer-token transport — so a break in the
chart's auth
templating, or in claim propagation, would go unnoticed.
This adds an `e2e-auth-jwt` job to the E2E workflow, running in parallel with
`e2e-smoke` on its own kind cluster. It asserts:
- The chart renders `auth.type: jwt` with the expected issuer and claim
mapping
(`tenant_claim`, `groups_claim`).
- A valid HS256 token is accepted, and the `sub` / `tenant` / `groups`
claims reach
the audit pipeline: the `session.create` event must report
**`user_id=alice`, not
`anonymous`**, plus `tenant=team-a` and `groups=devs,admins`.
- Three rejection paths fail with `UNAUTHENTICATED`: an expired token, a
token
signed with the wrong secret, and no token at all.
- **Signature-validation failures all report the same generic `"invalid
JWT"`.** A
verifier that distinguishes "expired" from "bad signature" tells an
attacker which
half to work on, so this is asserted rather than merely observed.
- The `auth.failure` audit events use only the fixed reasons `invalid_token`
and
`missing_token`, and `scg_auth_failures_total` counts both.
Tokens are signed with the 8-line `openssl` helper from the walkthrough — no
JWT
library needed. PySpark is pinned to `4.0.0` to match the backend image, as
in the
`e2e-smoke` job.
### Why are the changes needed?
Auth is the gateway's security boundary, and the chart's auth templating had
no
coverage at all: the unit tests never render the chart, and `e2e-smoke` runs
with
`auth: none`. This also pins down the deliberate non-disclosure property of
the
error messages, which is easy to regress by "improving" an error string.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Ran the whole walkthrough locally before writing the job: the chart rendered
the
expected auth block, the valid token produced `user_id=alice` /
`tenant=team-a` /
`groups=devs,admins` in the audit log, all three rejection paths returned
`UNAUTHENTICATED` with the expected messages (the two signature failures
with the
identical generic message), and the audit reasons and metrics matched
(`invalid_token` x4, `missing_token` x2). This PR's own run exercises the
job on a
hosted runner.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
